Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
TabbyML/tabby
main @ 21b2904
34
Fixes
0
CVEs
CRITICAL
Peak severity
25.9%
Coverage
Highlights
Auth Bypass: 23 prior fixes. Scrutinize any change in this area.
ee/tabby-webserver/src/schema/mod.rs: most-fixed (8 issues). Treat as high-risk during review.
29 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple GraphQL mutations and queries lacked admin authorization, allowing unauthorized repository, setting, and worker operations. The most severe was trusting JWT admin claims instead of authoritative service lookup.
Auth Bypass: Seat limits, demo-mode restrictions, and account-active checks were inconsistently enforced across registration, invitation, OAuth, and user activation paths, enabling license bypass and disabled-account authentication.
Auth Bypass: OAuth flows had multiple bypasses: missing client_secret, user-controlled redirect_uri, and missing seat checks during self-registration, allowing token manipulation and unauthorized account creation.